CVE-2026-75842

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75
https://www.vulncheck.com/advisories/arcadedb-before-arbitrary-file-read-via-load-csv
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Versiones de ArcadeDB anteriores a la 26.8.1 contienen una vulnerabilidad de lectura arbitraria de archivos en la cláusula OpenCypher LOAD CSV FROM que permite a usuarios autenticados leer archivos locales. Atacantes con privilegios de consulta de lectura pueden usar el protocolo file: // en sentencias LOAD CSV para acceder a archivos arbitrarios con privilegios del proceso del servidor, exfiltrando datos sensibles directamente en las respuestas de la consulta.

Information

Published : 2026-08-18 12:19

Updated : 2026-10-22 22:10

NVD link : CVE-2026-75842

Mitre link : CVE-2026-75842

CVE.ORG link : CVE-2026-75842

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-75842", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75842", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T14:22:52.384386Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "ArcadeData", "product": "arcadedb", "versions": [{"status": "affected", "version": "0", "lessThan": "26.8.1", "versionType": "semver"}, {"status": "unaffected", "version": "26.8.1", "versionType": "semver"}], "packageURL": "pkg:maven/com.arcadedb/arcadedb-engine", "defaultStatus": "unaffected"}]}], "published": "2026-08-18T12:19:34.597", "references": [{"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/arcadedb-before-arbitrary-file-read-via-load-csv", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses."}, {"lang": "es", "value": "Versiones de ArcadeDB anteriores a la 26.8.1 contienen una vulnerabilidad de lectura arbitraria de archivos en la cl\u00e1usula OpenCypher LOAD CSV FROM que permite a usuarios autenticados leer archivos locales. Atacantes con privilegios de consulta de lectura pueden usar el protocolo file: // en sentencias LOAD CSV para acceder a archivos arbitrarios con privilegios del proceso del servidor, exfiltrando datos sensibles directamente en las respuestas de la consulta."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "disclosure@vulncheck.com"}